Enum link_type_t

• Defined in File common.hh

Enum Documentation

enum libnokogiri::link_type_t

Defines the link layer of the interface.

This table and the descriptions of each link type has been directly lifted from https://www.tcpdump.org/linktypes.html.

Note: See the site linked above for details on the link_type_t::User0 through link_type_t::User15 values and other notes about reserved ranges.

TODO: Waiting on the tcpdump mailing list to respond to https://lists.sandelman.ca/pipermail/tcpdump-workers/2020-October/001548.html to see if we can add needed link types.

Values:

enumerator BSDLoopback

BSD loopback encapsulation; the link layer header is a 4-byte field, in host byte order, containing a value of 2 for IPv4 packets, a value of either 24, 28, or 30 for IPv6 packets, a value of 7 for OSI packets, or a value of 23 for IPX packets. All of the IPv6 values correspond to IPv6 packets; code reading files should check for all of them. Note that host byte order is the byte order of the machine on which the packets are captured; if a live capture is being done, host byte order is the byte order of the machine capturing the packets, but if a savefile is being read, the byte order is not necessarily that of the machine reading the capture file.

enumerator Ethernet

IEEE 802.3 Ethernet (10Mb, 100Mb, 1000Mb, and up).

enumerator AX25

AX.25 packet, with nothing preceding it.

enumerator IEEE802_5

IEEE 802.5 Token Ring.

enumerator ARCNET_BSD

ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999, but without the Starting Delimiter, Information Length, or Frame Check Sequence fields, and with only the first ISU of the Destination Identifier. For most packet types, ARCNET Trade Association draft standard ATA 878.2 is also used. See also RFC 1051 and RFC 1201; for RFC 1051 frames, ATA 878.2 is not used.

enumerator SLIP

SLIP, encapsulated with a LINKTYPE_SLIP header.

enumerator PPP

PPP, as per RFC 1661 and RFC 1662; if the first 2 bytes are 0xff and 0x03, it’s PPP in HDLC-like framing, with the PPP header following those two bytes, otherwise it’s PPP without framing, and the packet begins with the PPP header. The data in the frame is not octet-stuffed or bit-stuffed.

enumerator FDDI

FDDI, as specified by ANSI INCITS 239-1994.

enumerator PPP_HDLC

PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP with HDLC framing. The data in the frame is not octet-stuffed or bit-stuffed.

enumerator PPPoE

PPPoE; the packet begins with a PPPoE header, as per RFC 2516.

enumerator ATM_RFC1483

RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an ISO 8802-2 (formerly known as IEEE 802.2) LLC header.

enumerator Raw

Raw IP; the packet begins with an IPv4 or IPv6 header, with the version field of the header indicating whether it’s an IPv4 or IPv6 header.

enumerator CiscoHDLC

Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.

enumerator IEEE802_11

IEEE 802.11 wireless LAN.

enumerator LAPFFrameRelay

Frame Relay LAPF frames, beginning with a ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.

enumerator OpenBSDLoopback

OpenBSD loopback encapsulation; the link-layer header is a 4-byte field, in network byte order, containing a value of 2 for IPv4 packets, a value of either 24, 28, or 30 for IPv6 packets, a value of 7 for OSI packets, or a value of 23 for IPX packets. All of the IPv6 values correspond to IPv6 packets; code reading files should check for all of them.

enumerator LinuxSLL

Linux “cooked” capture encapsulation.

enumerator AppleLocalTalk

Apple LocalTalk; the packet begins with an AppleTalk LocalTalk Link Access Protocol header, as described in chapter 1 of Inside AppleTalk, Second Edition.

enumerator OpenBSDPFLog

OpenBSD pflog; the link-layer header contains a struct pfloghdr structure, as defined by the host on which the file was saved. (This differs from operating system to operating system and release to release; there is nothing in the file to indicate what the layout of that structure is.)

enumerator IEEE802_11_Prism

Prism monitor mode information followed by an 802.11 header.

enumerator IPOverFC

RFC 2625 IP-over-Fibre Channel, with the link-layer header being the Network_Header as described in that RFC.

enumerator SunATM

ATM traffic, encapsulated as per the scheme used by SunATM devices.

enumerator IEEE802_11_Radiotap

Radiotap link-layer information followed by an 802.11 header.

enumerator ARCNETLinux

ARCNET Data Packets, as described by the ARCNET Trade Association standard ATA 878.1-1999, but without the Starting Delimiter, Information Length, or Frame Check Sequence fields, with only the first ISU of the Destination Identifier, and with an extra two-ISU offset field following the Destination Identifier. For most packet types, ARCNET Trade Association draft standard ATA 878.2 is also used; however, no exception frames are supplied, and reassembled frames, rather than fragments, are supplied. See also RFC 1051 and RFC 1201; for RFC 1051 frames, ATA 878.2 is not used.

enumerator AppleIPOverIEEE1394

Apple IP-over-IEEE 1394 cooked header.

enumerator MTP2WithPHeader

Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703, preceded by a pseudo-header.

enumerator MTP2

Signaling System 7 Message Transfer Part Level 2, as specified by ITU-T Recommendation Q.703.

enumerator MTP3

Signaling System 7 Message Transfer Part Level 3, as specified by ITU-T Recommendation Q.704, with no MTP2 header preceding the MTP3 packet.

enumerator SCCP

Signaling System 7 Signaling Connection Control Part, as specified by ITU-T Recommendation Q.711, ITU-T Recommendation Q.712, ITU-T Recommendation Q.713, and ITU-T Recommendation Q.714, with no MTP3 or MTP2 headers preceding the SCCP packet.

enumerator DOCSIS

DOCSIS MAC frames, as described by the DOCSIS 3.1 MAC and Upper Layer Protocols Interface Specification or earlier specifications for MAC frames.

enumerator LinuxIrDA

Linux-IrDA packets, with a LINKTYPE_LINUX_IRDA header, with the payload for IrDA frames beginning with by the IrLAP header as defined by IrDA Data Specifications, including the IrDA Link Access Protocol specification.

enumerator User0

Reserved for private use; See note above.

enumerator User1

Reserved for private use; See note above.

enumerator User2

Reserved for private use; See note above.

enumerator User3

Reserved for private use; See note above.

enumerator User4

Reserved for private use; See note above.

enumerator User5

Reserved for private use; See note above.

enumerator User6

Reserved for private use; See note above.

enumerator User7

Reserved for private use; See note above.

enumerator User8

Reserved for private use; See note above.

enumerator User9

Reserved for private use; See note above.

enumerator User10

Reserved for private use; See note above.

enumerator User11

Reserved for private use; See note above.

enumerator User12

Reserved for private use; See note above.

enumerator User13

Reserved for private use; See note above.

enumerator User14

Reserved for private use; See note above.

enumerator User15

Reserved for private use; See note above.

enumerator IEEE802_11_AVS

AVS monitor mode information followed by an 802.11 header.

enumerator BACNet_MS_TP

BACnet MS/TP frames, as specified by section 9.3 MS/TP Frame Format of ANSI/ASHRAE Standard 135, BACnet® - A Data Communication Protocol for Building Automation and Control Networks, including the preamble and, if present, the Data CRC.

enumerator PPP_PPPD

PPP in HDLC-like encapsulation, like LINKTYPE_PPP_HDLC, but with the 0xff address byte replaced by a direction indication - 0x00 for incoming and 0x01 for outgoing.

enumerator GPRS_LLC

General Packet Radio Service Logical Link Control, as defined by 3GPP TS 04.64.

enumerator GPF_T

Transparent-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.

enumerator GPF_F

Frame-mapped generic framing procedure, as specified by ITU-T Recommendation G.7041/Y.1303.

enumerator LinuxLAPD

Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, captured via vISDN, with a LINKTYPE_LINUX_LAPD header, followed by the Q.921 frame, starting with the address field.

enumerator MFR

FRF.16.1 Multi-Link Frame Relay frames, beginning with an FRF.12 Interface fragmentation format fragmentation header.

enumerator BluetoothHCI_H4

Bluetooth HCI UART transport layer; the frame contains an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.

enumerator USBLinux

USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. Only the first 48 bytes of that header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file’s magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block.

enumerator PPI

Per-Packet Information information, as specified by the Per-Packet Information Header Specification, followed by a packet with the LINKTYPE_ value specified by the pph_dlt field of that header.

enumerator IEEE802_15_4_WithFCS

IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame.

enumerator SITA

Various link-layer types, with a pseudo-header, for SITA.

enumerator ERF

Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF records.

enumerator BluetoothHCI_H4WithPhdr

Bluetooth HCI UART transport layer; the frame contains a 4-byte direction field, in network byte order (big-endian), the low-order bit of which is set if the frame was sent from the host to the controller and clear if the frame was received by the host from the controller, followed by an HCI packet indicator byte, as specified by the UART Transport Layer portion of the most recent Bluetooth Core specification, followed by an HCI packet of the specified packet type, as specified by the Host Controller Interface Functional Specification portion of the most recent Bluetooth Core Specification.

enumerator AX25_KIDD

AX.25 packet, with a 1-byte KISS header containing a type indicator.

enumerator LAPD

Link Access Procedures on the D Channel (LAPD) frames, as specified by ITU-T Recommendation Q.920 and ITU-T Recommendation Q.921, starting with the address field, with no pseudo-header.

enumerator PPPWithDir

PPP, as per RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero value meaning “received by this host” and a non-zero value meaning “sent by this host”; if the first 2 bytes are 0xff and 0x03, it’s PPP in HDLC-like framing, with the PPP header following those two bytes, otherwise it’s PPP without framing, and the packet begins with the PPP header. The data in the frame is not octet-stuffed or bit-stuffed.

enumerator CiscoHDLCWithDir

Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547, preceded with a one-byte pseudo-header with a zero value meaning “received by this host” and a non-zero value meaning “sent by this host”.

enumerator FrameRelayWithDir

Frame Relay LAPF frames, beginning with a one-byte pseudo-header with a zero value meaning “received by this host” (DCE->DTE) and a non-zero value meaning “sent by this host” (DTE->DCE), followed by an ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.

enumerator LAPBWithDir

Link Access Procedure, Balanced (LAPB), as specified by ITU-T Recommendation X.25, preceded with a one-byte pseudo-header with a zero value meaning “received by this host” (DCE->DTE) and a non-zero value meaning “sent by this host” (DTE->DCE).

enumerator Ipmb_linux

IPMB over an I2C circuit, with a Linux-specific pseudo-header.

enumerator IEEE802_15_4_nonask_phy

IEEE 802.15.4 Low-Rate Wireless Networks, with each packet having the FCS at the end of the frame, and with the PHY-level data for the O-QPSK, BPSK, GFSK, MSK, and RCC DSS BPSK PHYs (4 octets of 0 as preamble, one octet of SFD, one octet of frame length + reserved bit) preceding the MAC-layer data (starting with the frame control field).

enumerator UUSBLinuxMmapped

USB packets, beginning with a Linux USB header, as specified by the struct usbmon_packet in the Documentation/usb/usbmon.txt file in the Linux source tree. All 64 bytes of the header are present. All fields in the header are in host byte order. When performing a live capture, the host byte order is the byte order of the machine on which the packets are captured. When reading a pcap file, the byte order is the byte order for the file, as specified by the file’s magic number; when reading a pcapng file, the byte order is the byte order for the section of the pcapng file, as specified by the Section Header Block. For isochronous transfers, the ndesc field specifies the number of isochronous descriptors that follow.

enumerator FC2

Fibre Channel FC-2 frames, beginning with a Frame_Header.

enumerator FC2WithFrameDelims

Fibre Channel FC-2 frames, beginning an encoding of the SOF, followed by a Frame_Header, and ending with an encoding of the SOF. The encodings represent the frame delimiters as 4-byte sequences representing the corresponding ordered sets, with K28.5 represented as 0xBC, and the D symbols as the corresponding byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, is represented as 0xBC 0xB5 0x55 0x55.

enumerator IPNET

Solaris ipnet pseudo-header, followed by an IPv4 or IPv6 datagram.

enumerator CANSocketCan

CAN (Controller Area Network) frames, with a pseudo-header followed by the frame payload.

enumerator IpV4

Raw IPv4; the packet begins with an IPv4 header.

enumerator IpV6

Raw IPv6; the packet begins with an IPv6 header.

enumerator IEEE802_15_4_nofcs

IEEE 802.15.4 Low-Rate Wireless Network, without the FCS at the end of the frame.

enumerator DBus

Raw D-Bus messages, starting with the endianness flag, followed by the message type, etc., but without the authentication handshake before the message sequence.

enumerator DVB_CI

DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver), with the message format specified by the PCAP format for DVB-CI specification.

enumerator Mux27010

Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but not the same as, 27.010).

enumerator Stanag5066DPDU

D_PDUs as described by NATO standard STANAG 5066, starting with the synchronization sequence, and including both header and data CRCs. The current version of STANAG 5066 is backwards-compatible with the 1.0.2 version, although newer versions are classified.

enumerator NFLog

Linux netlink NETLINK NFLOG socket log messages.

enumerator NetAnalyzer

Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the MAC header and ending with the FCS.

enumerator NetAnalyzerTransparent

Pseudo-header for Hilscher Gesellschaft für Systemautomation mbH netANALYZER devices, followed by an Ethernet frame, beginning with the preamble, SFD, and MAC header, and ending with the FCS.

enumerator IPoIB

IP-over-InfiniBand, as specified by RFC 4391 section 6.

enumerator MPEG2Transport

MPEG-2 Transport Stream transport packets, as specified by ISO 13818-1/ITU-T Recommendation H.222.0 (see table 2-2 of section 2.4.3.2 “Transport Stream packet layer”).

enumerator NG40

Pseudo-header for ng4T GmbH’s UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40 protocol tester, followed by frames for the Frame Protocol as specified by 3GPP TS 25.427 for dedicated channels and 3GPP TS 25.435 for common/shared channels in the case of ATM AAL2 or UDP traffic, by SSCOP packets as specified by ITU-T Recommendation Q.2110 for ATM AAL5 traffic, and by NBAP packets for SCTP traffic.

enumerator NFC_LLCP

Pseudo-header for NFC LLCP packet captures, followed by frame data for the LLCP Protocol as specified by NFCForum-TS-LLCP_1.1.

enumerator InfiniBand

Raw InfiniBand frames, starting with the Local Routing Header, as specified in Chapter 5 “Data packet format” of InfiniBand™ Architectural Specification Release 1.2.1 Volume 1 - General Specifications.

enumerator SCTP

SCTP packets, as defined by RFC 4960, with no lower-level protocols such as IPv4 or IPv6.

enumerator USBPcap

USB packets, beginning with a USBPcap header.

enumerator RTACSerial

Serial-line packet header for the Schweitzer Engineering Laboratories “RTAC” product, followed by a payload for one of a number of industrial control protocols.

enumerator BluetoothLELL

Bluetooth Low Energy air interface Link Layer packets, in the format described in section 2.1 “PACKET FORMAT” of volume 6 of the Bluetooth Specification Version 4.0 (see PDF page 2200), but without the Preamble.

enumerator Netlink

Linux Netlink capture encapsulation.

enumerator BluetoothLinuxMonitor

Bluetooth Linux Monitor encapsulation of traffic for the BlueZ stack.

enumerator Bluetooth_bredr_bb

Bluetooth Basic Rate and Enhanced Data Rate baseband packets.

enumerator BluetoothLELLWithPHDR

Bluetooth Low Energy link-layer packets.

enumerator PROFIBUSDatalink

PROFIBUS data link layer packets, as specified by IEC standard 61158-4-3, beginning with the start delimiter, ending with the end delimiter, and including all octets between them.

enumerator PKTAP

Apple PKTAP capture encapsulation.

enumerator EoPON

Ethernet-over-passive-optical-network packets, starting with the last 6 octets of the modified preamble as specified by 65.1.3.2 “Transmit” in Clause 65 of Section 5 of IEEE 802.3, followed immediately by an Ethernet frame.

enumerator IPMI_hpm_2

IPMI trace packets, as specified by Table 3-20 “Trace Data Block Format” in the PICMG HPM.2 specification. The time stamps for packets in this format must match the time stamps in the Trace Data Blocks.

enumerator ZWaveR1R2

Z-Wave RF profile R1 and R2 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.

enumerator ZWaveR3

Z-Wave RF profile R3 packets, as specified by ITU-T Recommendation G.9959, with some MAC layer fields moved.

enumerator WattStopperDLM

Formats for WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol common packet structure captures.

enumerator ISO14443

Messages between ISO 14443 contactless smartcards (Proximity Integrated Circuit Card, PICC) and card readers (Proximity Coupling Device, PCD), with the message format specified by the PCAP format for ISO14443 specification.

enumerator RDS

Radio data system (RDS) groups, as per IEC 62106, encapsulated in this form.

enumerator USBDarwin

USB packets, beginning with a Darwin (macOS, etc.) USB header.

enumerator SDLC

SDLC packets, as specified by Chapter 1, “DLC Links”, section “Synchronous Data Link Control (SDLC)” of Systems Network Architecture Formats, GA27-3136-20, without the flag fields, zero-bit insertion, or Frame Check Sequence field, containing SNA path information units (PIUs) as the payload.

enumerator LoRaTap

https://github.com/eriknl/LoRaTap/blob/master/README.md “LoRaTap pseudo-header”, followed by the payload, which is typically the PHYPayload from the LoRaWan specification.

enumerator VSOCK

Protocol for communication between host and guest machines in VMware and KVM hypervisors.

enumerator NordicBLE

Messages to and from a Nordic Semiconductor nRF Sniffer for Bluetooth LE packets, beginning with a pseudo-header.

enumerator DOCSIS31_XRA31

DOCSIS packets and bursts, preceded by a pseudo-header giving metadata about the packet.

enumerator Ethernet_mpacket

mPackets, as specified by IEEE 802.3br Figure 99-4, starting with the preamble and always ending with a CRC field.

enumerator DisplayportAux

DisplayPort AUX channel monitoring data as specified by VESA DisplayPort(DP) Standard preceded by a pseudo-header.

enumerator LinuxSLL2

Linux “cooked” capture encapsulation v2.

enumerator Openvizsla

Openvizsla FPGA-based USB sniffer.

enumerator EBHSCR

Elektrobit High Speed Capture and Replay (EBHSCR) format.

enumerator VPPDispatch

Records in traces from the http://fd.io VPP graph dispatch tracer, in the the graph dispatcher trace format.

enumerator DSATagBRCM

Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.

enumerator DSATagBRCMPrepend

Ethernet frames, with a switch tag inserted before the destination address in the Ethernet header.

enumerator IEEE802_15_4_Tap

IEEE 802.15.4 Low-Rate Wireless Networks, with a pseudo-header containing TLVs with metadata preceding the 802.15.4 header.

enumerator DSATagDSA

Ethernet frames, with a switch tag inserted between the source address field and the type/length field in the Ethernet header.

enumerator DSATagEDSA

Ethernet frames, with a programmable Ethernet type switch tag inserted between the source address field and the type/length field in the Ethernet header.

enumerator ELEE

Payload of lawful intercept packets using the ELEE protocol. The packet begins with the ELEE header; it does not include any transport-layer or lower-layer headers for protcols used to transport ELEE packets.

enumerator ZWaveSerial

Serial frames transmitted between a host and a Z-Wave chip over an RS-232 or USB serial connection, as described in section 5 of the Z-Wave Serial API Host Application Programming Guide.

enumerator USB2

USB 2.0, 1.1, or 1.0 packet, beginning with a PID, as described by Chapter 8 “Protocol Layer” of the the Universal Serial Bus Specification Revision 2.0.

enumerator ATSC_ALP

ATSC Link-Layer Protocol frames, as described in section 5 of the A/330 Link-Layer Protocol specification, found at the ATSC 3.0 standards page, beginning with a Base Header.